Coldcard Vulnerability Sparks Panic: Dormant Bitcoin Whales Transfer Billions in BTC as Cold Wallets Face Security Crisis
2026/08/04 11:35:00
Five-Year Coldcard Seed Generation Bug Put Millions in Bitcoin at Risk
A long-standing integration error in the Coldcard firmware, which has persisted for five years, significantly diminished the effective entropy of numerous device-generated seeds. This vulnerability allowed malicious actors to reconstruct private keys offline, enabling them to sweep funds from Bitcoin addresses that had remained inactive for many years. An extensive on-chain analysis conducted by Galaxy Research identified successive waves of transfers that totaled approximately 1,367 BTC, which was valued at around $88.6 million at that time. These transfers exhibited patterns that were consistent with the identified vulnerability.
Coinkite, the manufacturer of Coldcard, acknowledged the issue in a detailed security advisory, subsequently released fixed firmware to address the problem, and provided clear instructions for users whose seeds were created on the affected versions. They urged these users to migrate to new seeds that would be generated after the application of the patch. This incident shows the critical fact that even air-gapped hardware, which is often considered secure, can inadvertently introduce software-level weaknesses that may persist over years of dormancy. This situation necessitates a thorough reassessment of the assumptions surrounding cold-storage security practices, although it is important to note that this does not imply that every Coldcard user is at risk of exposure.
Entropy Collapse Traced to a 2021 Firmware Change
A thorough technical examination conducted by Block’s Bitcoin engineering team revealed that a significant commit made in March 2021 resulted in a notable alteration in the seed generation process. This change transitioned from a direct call to the STM32 hardware random-number generator, which is known for its efficiency and security, to a more convoluted path through the ngu.random library. In the production configuration, the setting for MICROPY_HW_ENABLE_RNG was defined as zero. This was due to the fact that Coldcard, a prominent hardware wallet manufacturer, supplied its own wrapper for random number generation. However, it is important to note that the library only checked for the existence of the macro rather than verifying its enabled state, which is a crucial distinction.
As a consequence of this oversight, the system ended up binding to MicroPython’s deterministic Yasmarang software fallback. This fallback mechanism was initialized using the unique ID of the chip and the timer registers, which are integral to the device's operation. On devices such as the Mk2 and Mk3, which were running firmware versions ranging from 4.0.0 to 4.1.9, it was found that no additional cryptographic entropy was introduced into the seed generation process. This unfortunate situation led to a collapse of the practical search space, bringing it far below the expected 128 bits that are typically required for a standard BIP-39 seed.
In subsequent models, a limited secure-element reseed was introduced, but this only retained a mere 32 bits in practice, which is significantly lower than what is generally considered secure. Furthermore, the deterministic hashing of the output generated by these devices could not expand the candidate set, which is a critical factor in ensuring the security of the generated seeds. It is also worth mentioning that updating the firmware on these devices does not alter the existing seeds; only newly generated seeds created on patched versions of the firmware benefit from the necessary corrections that address these vulnerabilities.
On-Chain Waves Map to Thousands of Addresses in Hours
Galaxy Research conducted a comprehensive analysis that documented an initial sweep involving a total of 1,196 unique addresses, which collectively moved an impressive 1,082.65 BTC within a remarkably short 41-minute window on the date of 30 July 2026. This initial activity was followed by several additional waves of transactions that ultimately raised the observed total to an approximate amount of 1,367 BTC, spread across more than 4,500 distinct addresses. Notably, many of the source addresses involved in these transactions had been dormant for an extended period, often for years, and they held balances that were significantly above the typical thresholds considered to be "dust."
The characteristics of the transactions, including uniform fee rates and the absence of change outputs, formed a distinctive and recognizable pattern. This pattern allowed for effective clustering of the addresses without the necessity of proving that every single address originated from a weak Coldcard seed. The receiving addresses exhibited a rapid consolidation of funds, which was consistent with the automated recovery of enumerable keys, rather than indicating any physical compromise of the devices involved. Despite the extensive analysis, no public reconstruction of a specific victim seed has been published to date. However, it is worth noting that the volume of transactions and their timing aligned closely with the previously disclosed reduction in entropy, suggesting a significant correlation between these events.
Coinkite Advisory Sets Clear Migration Boundaries
Coinkite’s official advisory, which has been updated through early August 2026, has clearly stated that funds that are controlled by seeds generated on Mk2 or Mk3 firmware versions ranging from 4.0.1 to 4.1.9 are at significant risk unless at least 50 independent private dice rolls are added to enhance security, or a strong and unique BIP-39 passphrase is employed to protect the wallet effectively. Furthermore, seeds that were created on Mk4, Q, and Mk5 prior to the release of the fixed versions carry a reduced level of entropy, which is estimated to be around 72 bits. The fixed firmware versions, specifically 4.2.0 for Mk2 and Mk3, 5.6.0 for the standard Mk4 and Mk5, 1.5.0Q for Q, along with the corresponding Edge builds, ensure the correct generation of future seeds.
It is important to note that a sufficient number of dice rolls, combined with privacy measures, can effectively neutralize the weaknesses generated by the device; additionally, passphrases provide a separate layer of security that must still be guessed by potential attackers. Notably, TAPSIGNER, OPENDIME, and SATSCARD remain completely unaffected by these issues because they utilize different codebases altogether. The company has emphasized the importance of a calm and methodical migration process: users should verify their backups, generate a new seed only after they have successfully installed the fixed firmware, conduct tests with a small amount of funds, and only then proceed to move the remaining balance to ensure safety and security.
Dormant Holdings Become Visible Targets Overnight
The attacker’s capability to recover keys offline has resulted in a situation where wallets that have remained untouched for many years have suddenly become accessible and vulnerable. Addresses that had previously received coins during earlier market cycles and subsequently sat idle for extended periods were systematically scanned against a significantly reduced candidate space. This scanning process produced the misleading appearance of coordinated “whale” activity in the market; however, the underlying mechanism driving this phenomenon was cryptographic enumeration rather than any coordinated decisions made by the owners of the wallets.
Blockchain data analysis confirmed that numerous addresses that were swept shared the common characteristic of having long periods of dormancy, followed by a rapid emptying of their contents into a small set of consolidating destinations. This observed pattern illustrates how a single regression in firmware can transform what was once considered static cold storage into a time-sensitive risk, particularly once the weakness in the system becomes known or is independently rediscovered by malicious actors.
Practical Differences Across Coldcard Generations
Mk2 and Mk3 devices that are operating on the vulnerable firmware path have been found to provide essentially no cryptographic entropy beyond the deterministic fallback mechanism. This limitation makes exhaustive search attacks feasible once device identifiers and timing constraints are accurately modeled. In contrast, the Mk4, Q, and Mk5 models have retained a 32-bit reseed from the secure element, which raises the candidate count significantly but still falls short of achieving the full 128-bit security standard that is desired. It is important to note that exposure to potential vulnerabilities is determined solely by the firmware version that was present at the time of seed creation, rather than the current version that is installed on the device.
Users who have generated seeds with substantial dice entropy or who have taken the precaution of protecting their seeds with robust passphrases face a materially lower immediate risk. However, Coinkite still recommends that these groups consider eventual migration to more secure options. Furthermore, multisignature setups that include at least one key that is unaffected by these vulnerabilities remain more resilient and secure compared to single-signature arrangements that are built entirely on seeds that are known to be vulnerable.
Industry Analysis Highlights Software Path Failures
Independent reviews have shown that the hardware true-random-number generator integrated into the STM32 microcontroller was indeed present and fully functional throughout the entire affected period. However, it was observed that a regression in the software simply ceased to call this generator correctly, leading to issues. The Yasmarang fallback mechanism, which was designed to collect entropy, only gathered this randomness once during the initialization phase and subsequently produced a deterministic stream of output. This means that after the initial collection of entropy, the system relied on predictable outputs rather than true randomness. Furthermore, in later models, the process of reseeding truncated the output from the secure element to a mere four bytes, which significantly limited the state space available for secure operations.
These critical details were published by Block and have been corroborated by Coinkite’s own technical backgrounder, which clearly demonstrates that the failure in question was primarily an integration error rather than a hardware defect or an intentional backdoor designed to compromise security. This incident comes shortly after separate research into weak pseudo-random number generators (weak-PRNG) that affected older software wallets, reinforcing the notion that the quality of entropy remains a recurring and significant point of failure across both software and hardware generations. This ongoing issue shows the importance of robust entropy generation methods in ensuring the security of digital wallets and the broader implications for the cryptocurrency ecosystem.
Market Response and Immediate User Actions
In the days following the disclosure, the price action of Bitcoin exhibited a modest level of pressure, which can be partially attributed to the news surrounding the incident. However, it is important to note that broader market factors also played a significant role in influencing trading activities during this period. More notably, there was a substantial increase in the number of user guidance requests and a marked uptick in firmware download activity. Security researchers, along with on-chain monitors, strongly urged holders of Bitcoin to take proactive measures by verifying their generation methods.
They recommended installing fixed firmware prior to creating any replacement seeds and advised against restoring vulnerable seeds onto any device, as this could pose significant risks. For those who were uncertain about the integrity of their dice-roll counts or the strength of their passphrases, it was recommended that they treat their funds as exposed and complete the migration process as promptly as possible. This particular episode has significantly accelerated discussions regarding the importance of independent entropy verification and has highlighted the value of implementing multi-device and multi-vendor key schemes in enhancing security.
Future Effects for Hardware Wallet Design
The five-year delay between the introduction of the regression and its eventual public exploitation serves as a significant illustration of the considerable challenges associated with auditing complex embedded codebases, particularly those that are shipped infrequently. The reliance on open-source or source-verifiable claims offers only limited protection, especially in scenarios where the critical path diverges from the intended hardware entropy source.
As we look toward future designs, there may be a greater emphasis placed on implementing continuous entropy health checks, the mandatory use of high-entropy dice or external entropy sources, and a clearer separation between the paths of generation and signing. Users who once viewed air-gapped devices as permanent and foolproof solutions are now faced with the sobering reality that the software state at the precise moment of seed creation can have profound implications for security many years down the line.
Verification Steps for Existing Holders
Owners are strongly encouraged to begin by thoroughly determining the precise firmware version that was present at the time when the seed was generated. If it is found that this specific version falls within the published ranges of concern, and if it is also the case that neither sufficient dice entropy nor a robust passphrase was utilized during the seed generation process, then it is advisable that the seed be retired immediately. It is imperative that fixed firmware be installed prior to generating any replacement seed to ensure security.
Conducting a small test transfer is essential to confirm that the new wallet operates correctly and functions as intended before proceeding to move the bulk of funds. Furthermore, written backups of both the old and new seeds must be meticulously verified against the device fingerprints to ensure accuracy and security. Rushing through this entire process can introduce secondary risks of loss or exposure, which may ultimately exceed the original vulnerability that prompted these precautions in the first place.
Context of Self-Custody Assumptions
The recent incident does not serve to invalidate hardware wallets as a category or class of security devices; rather, it effectively isolates a specific failure in implementation that has resulted in a subset of seeds being weaker than what was originally advertised. Historically, comparable issues related to entropy have also surfaced in software wallets and various other hardware platforms. What sets this situation apart is the prolonged dormancy of many of the targeted addresses, which, when combined with the offline nature of the recovery process, creates unique challenges.
Holders who specifically adopted the Coldcard wallet with the intention of avoiding the risks associated with exchanges and hot wallets are now faced with the pressing necessity of maintaining continuous vigilance over their seed generation practices as well as the provenance of their firmware. This situation underscores the importance of being proactive and diligent in ensuring the security of their assets.
Continued Investigation and Attribution Limits
No specific identity of the attacker has been publicly confirmed or established at this time. Galaxy Research has reported the existence of clusters of addresses that appear to be consistent with the same operator across the initial waves of activity, while also cautioning against the assumption that a single actor is responsible for all of the observed activity. Transaction signatures and fee patterns have provided some clustering signals that suggest potential connections; however, the absence of any on-device interaction means that traditional forensic trails are significantly limited in their effectiveness.
Federal and compliance entities have received detailed lists of suspected destination addresses that may be linked to the activity in question. Independent investigators have shown a varied willingness to pursue further tracing of these addresses, often citing considerations related to available resources and the incentives involved in such investigations.
Recovery and Future Seed Hygiene
Once funds have been successfully transferred to a new seed that has been generated under fixed firmware conditions, it is crucial to treat the old seed as compromised and to ensure that it is never reused in any capacity. Dice rolls, when conducted privately and in a sufficient quantity, continue to serve as a viable and independent source of entropy. Additionally, passphrases provide an important orthogonal layer of security, as long as they are unique and possess a high level of entropy.
Users who are in the process of generating new wallets are strongly advised to confirm the firmware version directly on the device before they initiate the wallet creation process. It is also recommended that they meticulously record the method used for seed generation for future reference. By adhering to these best practices, users can significantly reduce the likelihood that a similar regression in security will leave their holdings vulnerable and exposed to potential threats in the years to come.
|
KuCoin is celebrating its 9th anniversary with a special platform campaign filled with exclusive rewards, trading activities, and limited-time offers. Don’t miss the chance to participate and enjoy the benefits as the exchange marks nine years of growth and innovation. Visit the official campaign page now:
|
FAQ
What firmware versions placed Coldcard seeds at risk?
Seeds generated on Mk2 and Mk3 devices running versions from 4.0.0 or 4.0.1 through 4.1.9, and on Mk4, Q, and Mk5 devices before the July 2026 fixed releases, carry reduced entropy. Later firmware does not repair an existing weak seed; only seeds created after installing the corrected versions benefit.
Does installing the new firmware protect an old seed?
No. Firmware updates correct the generation process for new seeds only. An already-created seed retains whatever entropy level existed at the moment of its creation. Migration to a freshly generated seed on patched firmware is required.
Are dice-roll seeds safe?
If at least 50 independent private dice rolls were added during generation, the dice entropy alone supplies the necessary strength and neutralizes the device-generator weakness. Uncertainty about the number or privacy of rolls means the seed should be treated as exposed.
How does a BIP-39 passphrase change the risk?
A strong, unique passphrase creates a separate wallet that the weak seed alone cannot unlock. Short or common passphrases remain guessable and do not fully mitigate the issue. Even passphrase-protected wallets should eventually migrate to a new seed.
Which Coldcard products are unaffected?
TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are not impacted. Multisignature arrangements that include at least one key generated outside the vulnerable path retain greater resilience.
Disclaimer: This content is for informational purposes only and does not constitute investment advice. Cryptocurrency investments carry risk. Please do your own research (DYOR).